Skip to content

Commit aaf274c

Browse files
andrewkrohandrewkroh
authored
[cylance] Format host.mac per ECS (#3368)
Format host.mac as per ECS. It needed to be uppercased, dash separated, and converted to an array.
1 parent 550a92c commit aaf274c

File tree

9 files changed

+231
-14
lines changed

9 files changed

+231
-14
lines changed

‎packages/cylance/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,13 @@ services:
77
- ${SERVICE_LOGS_DIR}:/var/log
88
command: /bin/sh -c "cp /sample_logs/* /var/log/"
99
cylance-protect-udp:
10-
image: akroh/stream:v0.2.0
10+
image: docker.elastic.co/observability/stream:v0.7.0
1111
volumes:
1212
- ./sample_logs:/sample_logs:ro
1313
entrypoint: /bin/bash
1414
command: -c "/stream log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9529 -p=udp /sample_logs/cylance-protect-*.log"
1515
cylance-protect-tcp:
16-
image: akroh/stream:v0.2.0
16+
image: docker.elastic.co/observability/stream:v0.7.0
1717
volumes:
1818
- ./sample_logs:/sample_logs:ro
1919
entrypoint: /bin/bash

‎packages/cylance/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "0.8.1"
3+
changes:
4+
- description: Format host.mac as per ECS.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/3368
27
- version: "0.8.0"
38
changes:
49
- description: Update to ECS 8.2.0

‎packages/cylance/data_stream/protect/_dev/test/pipeline/test-common-config.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
dynamic_fields:
2-
event.ingested: ".*"
31
fields:
42
tags:
53
- preserve_original_event

‎packages/cylance/data_stream/protect/_dev/test/pipeline/test-rsa2elk-output.json‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
{
2+
"events": [
3+
{
4+
"@timestamp": "2022-02-24T07:26:15.000Z",
5+
"agent": {
6+
"ephemeral_id": "354b040b-34b0-4afd-a65e-f9b5218ab48b",
7+
"id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2",
8+
"name": "docker-fleet-agent",
9+
"type": "filebeat",
10+
"version": "8.1.3"
11+
},
12+
"data_stream": {
13+
"dataset": "cylance.protect",
14+
"namespace": "ep",
15+
"type": "logs"
16+
},
17+
"ecs": {
18+
"version": "8.0.0"
19+
},
20+
"elastic_agent": {
21+
"id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2",
22+
"snapshot": false,
23+
"version": "8.1.3"
24+
},
25+
"event": {
26+
"action": "DeviceRemove",
27+
"code": "CylancePROTECT",
28+
"dataset": "cylance.protect",
29+
"original": "24-Feb-2018 7:26:15 very-high idolor3916.www5.home tas \u003c\u003cautfugi\u003etasun 24T19:26:15.duntutla ntium4450.www5.localdomain CylancePROTECT Event Name:DeviceRemove, Device Name:vol, Agent Version:oremquel, IP Address: (10.22.94.10), MAC Address: (01:00:5e:ee:e8:77), Logged On Users: (ssusci), OS:animid, Zone Names:mpo",
30+
"timezone": "+00:00"
31+
},
32+
"host": {
33+
"mac": "01:00:5e:ee:e8:77",
34+
"name": "ntium4450.www5.localdomain"
35+
},
36+
"input": {
37+
"type": "log"
38+
},
39+
"log": {
40+
"file": {
41+
"path": "/tmp/service_logs/cylance-protect-generated.log"
42+
},
43+
"offset": 14198
44+
},
45+
"observer": {
46+
"product": "Protect",
47+
"type": "Anti-Virus",
48+
"vendor": "Cylance"
49+
},
50+
"related": {
51+
"ip": [
52+
"10.22.94.10"
53+
],
54+
"user": [
55+
"ssusci"
56+
]
57+
},
58+
"rsa": {
59+
"db": {
60+
"index": "mpo"
61+
},
62+
"internal": {
63+
"messageid": "CylancePROTECT"
64+
},
65+
"investigations": {
66+
"event_cat": 1804020000,
67+
"event_cat_name": "Network.Devices.Removals"
68+
},
69+
"misc": {
70+
"OS": "animid",
71+
"event_type": "DeviceRemove",
72+
"node": "vol"
73+
},
74+
"network": {
75+
"alias_host": [
76+
"ntium4450.www5.localdomain"
77+
],
78+
"eth_host": "01:00:5e:ee:e8:77"
79+
},
80+
"time": {
81+
"event_time": "2022-02-24T07:26:15.000Z"
82+
}
83+
},
84+
"source": {
85+
"ip": "10.22.94.10"
86+
},
87+
"tags": [
88+
"forwarded",
89+
"preserve_original_event"
90+
],
91+
"user": {
92+
"name": "ssusci"
93+
}
94+
}
95+
]
96+
}

‎packages/cylance/data_stream/protect/_dev/test/pipeline/test-rsa2elk-output.json-expected.json‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2022-02-24T07:26:15.000Z",
5+
"agent": {
6+
"ephemeral_id": "354b040b-34b0-4afd-a65e-f9b5218ab48b",
7+
"id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2",
8+
"name": "docker-fleet-agent",
9+
"type": "filebeat",
10+
"version": "8.1.3"
11+
},
12+
"data_stream": {
13+
"dataset": "cylance.protect",
14+
"namespace": "ep",
15+
"type": "logs"
16+
},
17+
"ecs": {
18+
"version": "8.2.0"
19+
},
20+
"elastic_agent": {
21+
"id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2",
22+
"snapshot": false,
23+
"version": "8.1.3"
24+
},
25+
"event": {
26+
"action": "DeviceRemove",
27+
"code": "CylancePROTECT",
28+
"dataset": "cylance.protect",
29+
"original": "24-Feb-2018 7:26:15 very-high idolor3916.www5.home tas \u003c\u003cautfugi\u003etasun 24T19:26:15.duntutla ntium4450.www5.localdomain CylancePROTECT Event Name:DeviceRemove, Device Name:vol, Agent Version:oremquel, IP Address: (10.22.94.10), MAC Address: (01:00:5e:ee:e8:77), Logged On Users: (ssusci), OS:animid, Zone Names:mpo",
30+
"timezone": "+00:00"
31+
},
32+
"host": {
33+
"mac": [
34+
"01-00-5E-EE-E8-77"
35+
],
36+
"name": "ntium4450.www5.localdomain"
37+
},
38+
"input": {
39+
"type": "log"
40+
},
41+
"log": {
42+
"file": {
43+
"path": "/tmp/service_logs/cylance-protect-generated.log"
44+
},
45+
"offset": 14198
46+
},
47+
"observer": {
48+
"product": "Protect",
49+
"type": "Anti-Virus",
50+
"vendor": "Cylance"
51+
},
52+
"related": {
53+
"hosts": [
54+
"ntium4450.www5.localdomain"
55+
],
56+
"ip": [
57+
"10.22.94.10"
58+
],
59+
"user": [
60+
"ssusci"
61+
]
62+
},
63+
"rsa": {
64+
"db": {
65+
"index": "mpo"
66+
},
67+
"internal": {
68+
"messageid": "CylancePROTECT"
69+
},
70+
"investigations": {
71+
"event_cat": 1804020000,
72+
"event_cat_name": "Network.Devices.Removals"
73+
},
74+
"misc": {
75+
"OS": "animid",
76+
"event_type": "DeviceRemove",
77+
"node": "vol"
78+
},
79+
"network": {
80+
"alias_host": [
81+
"ntium4450.www5.localdomain"
82+
],
83+
"eth_host": "01:00:5e:ee:e8:77"
84+
},
85+
"time": {
86+
"event_time": "2022-02-24T07:26:15.000Z"
87+
}
88+
},
89+
"source": {
90+
"ip": "10.22.94.10"
91+
},
92+
"tags": [
93+
"preserve_original_event"
94+
],
95+
"user": {
96+
"name": "ssusci"
97+
}
98+
}
99+
]
100+
}

‎packages/cylance/data_stream/protect/_dev/test/system/test-udp-config.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,6 @@ data_stream:
55
vars:
66
udp_host: 0.0.0.0
77
udp_port: 9529
8+
tags:
9+
- forwarded
10+
- preserve_original_event

‎packages/cylance/data_stream/protect/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,20 @@ processors:
55
- set:
66
field: ecs.version
77
value: '8.2.0'
8+
- gsub:
9+
field: host.mac
10+
ignore_missing: true
11+
pattern: '[:]'
12+
replacement: '-'
13+
- uppercase:
14+
field: host.mac
15+
ignore_missing: true
16+
- script:
17+
description: Convert host.mac to an array.
18+
if: ctx.host?.mac != null && ctx.host.mac instanceof String
19+
lang: painless
20+
source:
21+
ctx.host.mac = [ctx.host.mac];
822
# User agent
923
- user_agent:
1024
field: user_agent.original

‎packages/cylance/data_stream/protect/sample_event.json‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
22
"@timestamp": "2016-01-29T06:09:59.000Z",
33
"agent": {
4-
"ephemeral_id": "b747ad16-71f9-4ee3-80f1-e9c6e453cec1",
5-
"id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0",
4+
"ephemeral_id": "59f54338-3ade-4554-a66e-005e3f777eec",
5+
"id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2",
66
"name": "docker-fleet-agent",
77
"type": "filebeat",
8-
"version": "8.0.0"
8+
"version": "8.1.3"
99
},
1010
"data_stream": {
1111
"dataset": "cylance.protect",
@@ -16,16 +16,17 @@
1616
"version": "8.2.0"
1717
},
1818
"elastic_agent": {
19-
"id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0",
20-
"snapshot": true,
21-
"version": "8.0.0"
19+
"id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2",
20+
"snapshot": false,
21+
"version": "8.1.3"
2222
},
2323
"event": {
2424
"action": "ZoneAdd",
2525
"agent_id_status": "verified",
2626
"code": "CylancePROTECT",
2727
"dataset": "cylance.protect",
28-
"ingested": "2022-01-25T12:14:23Z",
28+
"ingested": "2022-05-17T13:06:35Z",
29+
"original": "29-January-2016 06:09:59 high boNemoe4402.www.invalid dolore \u003c\u003csequa\u003eabo 2016-1-29T6:09:59.squira nostrud4819.mail.test CylancePROTECT mqui nci [billoi] Event Type: AuditLog, Event Name: ZoneAdd, Message: Policy Assigned:orev; Devices: pisciv , User: uii umexe (estlabo)",
2930
"timezone": "+00:00"
3031
},
3132
"host": {
@@ -78,7 +79,7 @@
7879
}
7980
},
8081
"tags": [
81-
"cylance-protect",
82-
"forwarded"
82+
"forwarded",
83+
"preserve_original_event"
8384
]
8485
}

‎packages/cylance/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 1.0.0
22
name: cylance
33
title: CylanceProtect Logs
4-
version: 0.8.0
4+
version: "0.8.1"
55
description: Collect logs from CylanceProtect devices with Elastic Agent.
66
categories: ["security"]
77
release: experimental

0 commit comments

Comments
 (0)